Repository navigation
HTTP Basic: decode credentials as UTF-8, advertise charset, read token68 challenges - #1615
Merged
Merged
Conversation
…n68 challenges - The server decodes the credentials as UTF-8 and falls back to ISO-8859-1 if the bytes are not valid UTF-8; a Basic ChallengeAuthenticator advertises charset="UTF-8" (RFC 7617 section 2.1); a ChallengeResponse built from such a challenge copies the charset so the client encodes UTF-8. Issue #1455. - A WWW-Authenticate challenge made of a token68 ending with "=" (Negotiate) was dropped with the whole header. Issue #191. Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
…insensitive parameters - ChallengeAuthenticator gets setCredentialsCharset (UTF-8 by default, advertised in the challenge when it is UTF-8) and setCredentialsFallbackCharset (ISO-8859-1 by default, null for none). The authenticator decodes the credentials again when they differ from the default decoding, which lets a deployment restore ISO-8859-1. - The realm and charset parameters of a Basic challenge are matched case-insensitively (RFC 9110 section 11.2). Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Another test of the suite can leave a Restlet engine without the Basic authenticator helper (seen on CI, depending on the test order): the new tests now register a complete engine first. Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The aim
Fixes #1455. Fixes #191.
charset="UTF-8"only if the developer set it by hand, and always decoded the credentials as ISO-8859-1, so UTF-8 logins and passwords (zoë,p€ss) could not work (RFC 7617 section 2.1).WWW-Authenticate: Negotiate <base64>==, Basic realm="a": the=padding of a token68 (RFC 9110 section 11.2) made the reader throw, and the whole header, Basic challenge included, was dropped.The solution
Breaking (HTTP Basic):
Credentials received by a server are decoded as UTF-8, falling back to ISO-8859-1 when the bytes are not valid UTF-8 (clients sending ISO-8859-1 keep working, except when their bytes also happen to be valid UTF-8).
A
ChallengeAuthenticatorwithHTTP_BASICadvertisescharset="UTF-8".A
ChallengeResponsebuilt from a challenge request copies itscharset, so the client encodes UTF-8 when the server asked for it.The charsets are configurable per authenticator:
ChallengeAuthenticator.setCredentialsCharset()(UTF-8 by default;charset="UTF-8"is advertised only when it is UTF-8, the one value RFC 7617 allows) andsetCredentialsFallbackCharset()(ISO-8859-1 by default,nullto reject bytes that are not valid UTF-8). The authenticator decodes the raw credentials again when its settings differ from the default decoding, so a deployment hit by the rare collision (a Latin-1 password whose bytes are also valid UTF-8, e.g.é) can restore ISO-8859-1.Bug fixes:
ChallengeRequestReaderreads a token68 ending with=.realmandcharsetparameters of a Basic challenge are matched case-insensitively (RFC 9110 section 11.2);Realm=used to give a null realm.Reproduction
Before: a Basic call with login
zoë/ passwordp€sssent in UTF-8 gets a 401;ChallengeRequestReader("Negotiate YIIabc==, Basic realm=\"a\"").readValues()is empty.Check-list
Companions for 2.7 and 2.6: the Basic part is opt-in there (system property
org.restlet.engine.security.basic.utf8).🤖 Generated with Claude Code